High-severity CVEs (page 99)
Page 99 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-48133 | High | 7.5 | 2026-05-26 | When the Identity Awareness blade is enabled with Browser-Based Authentication, an unauthenticated user may be able to read certain internal files on the Secur… |
CVE-2026-48132 | High | 8.1 | 2026-05-26 | The Security Gateway does not correctly validate a length value in certain IKE packets when NAT-T is used (4500/UDP). As a result, a specially crafted or malfo… |
CVE-2026-48131 | High | 8.1 | 2026-05-26 | The VPN service may mishandle an unexpected IKE fragment value received on the IKE port 500/UDP during the early stage of a connection attempt. This can cause… |
CVE-2025-11482 | High | 7.5 | 2026-05-26 | An Allocation of Resources Without Limits or Throttling vulnerability in the OPC-UA Server used in PPT30 Operating System versions before 1.8.0 may be used by… |
CVE-2026-39661 | High | 7.5 | 2026-05-26 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magentech SW Core allows PHP Local Fil… |
CVE-2026-25713 | High | 7.8 | 2026-05-26 | MediaArea MediaInfoLib ID3v2 parsing heap buffer overflow vulnerability |
CVE-2026-25104 | High | 7.8 | 2026-05-26 | MediaArea MediaInfoLib LXF parsing heap-based buffer overflow vulnerability |
CVE-2026-8047 | High | 7.5 | 2026-05-26 | The affected products perform improper length checking when parsing incoming HTTP requests, resulting in a size-limited out-of-bounds write. An unauthenticated… |
CVE-2026-8046 | High | 8.1 | 2026-05-26 | The affected products insufficiently verify authorization when deleting user accounts. An authenticated, low-privileged remote user can exploit this vulnerabil… |
CVE-2026-44469 | High | 7.8 | 2026-05-26 | The affected product extracts installation files to a temporary directory with incorrect default permissions during administrative installation. A low-privileg… |
CVE-2026-44468 | High | 7.8 | 2026-05-26 | The affected product creates a directory with insecure default permissions during administrative installation. This allows a low-privileged local attacker to m… |
CVE-2026-9496 | High | 7.5 | 2026-05-26 | Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this… |
CVE-2026-9495 | High | 7.3 | 2026-05-26 | Versions of the package @koa/router from 14.0.0 and before 15.0.0 are vulnerable to Access Control Bypass due to the middleware being silently dropped from the… |
CVE-2026-9528 | High | 7.3 | 2026-05-26 | A vulnerability was identified in itsourcecode Electronic Judging System 1.0. Impacted is an unknown function of the file /admin/delete_judge.php. Such manipul… |
CVE-2026-9526 | High | 7.3 | 2026-05-26 | A vulnerability was found in itsourcecode Electronic Judging System 1.0. This vulnerability affects unknown code of the file /admin/edit_team.php. The manipula… |
CVE-2026-9525 | High | 7.3 | 2026-05-26 | A vulnerability has been found in itsourcecode Electronic Judging System 1.0. This affects an unknown part of the file /admin/edit_judge.php. The manipulation… |
CVE-2026-9523 | High | 7.3 | 2026-05-26 | A vulnerability was detected in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 3000WEBV2. Affected by this vulnerability is an… |
CVE-2026-9538 | High | 7.5 | 2026-05-26 | Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header. _read_tar() reads each entry's payl… |
CVE-2026-9521 | High | 7.3 | 2026-05-26 | A security vulnerability has been detected in fraillt bitsery up to 5.2.4. Affected is the function loadFromSharedState in the library include/bitsery/ext/std_… |
CVE-2026-42497 | High | 7.5 | 2026-05-26 | Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory. _make_special_file() passes the ta… |
CVE-2026-9517 | High | 7.3 | 2026-05-26 | A vulnerability was determined in hemant6488 CodeIgniter-StudentManagementSystem. The affected element is an unknown function of the file /index.php/students/a… |
CVE-2026-48837 | High | 8.5 | 2026-05-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements For Elementor allows Blind SQL Injecti… |
CVE-2026-45438 | High | 7.5 | 2026-05-25 | Missing Authorization vulnerability in WebToffee Smart Coupons for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This i… |
CVE-2026-45216 | High | 8.8 | 2026-05-25 | Incorrect Privilege Assignment vulnerability in StoreApps Smart Manager allows Privilege Escalation. This issue affects Smart Manager: from n/a through 8.85.0. |
CVE-2026-45209 | High | 7.5 | 2026-05-25 | Missing Authorization vulnerability in edward_plainview MyCryptoCheckout allows Exploiting Incorrectly Configured Access Control Security Levels. This issue a… |
CVE-2026-39436 | High | 7.1 | 2026-05-25 | Cross-Site Request Forgery (CSRF) vulnerability in bgermann CformsII allows Cross Site Request Forgery. This issue affects CformsII: from n/a through 15.1.3. |
CVE-2026-24937 | High | 7.2 | 2026-05-25 | Improper Control of Generation of Code ('Code Injection') vulnerability in VideoWhisper.Com Broadcast Live Video allows Code Injection. This issue affects Bro… |
CVE-2026-48848 | High | 7.2 | 2026-05-25 | Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascading Style Sheets (CSS) injection via an… |
CVE-2026-48844 | High | 7.5 | 2026-05-25 | Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection… |
CVE-2026-48843 | High | 7.2 | 2026-05-25 | Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may… |
CVE-2026-48842 | High | 8.1 | 2026-05-25 | Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash e… |
CVE-2026-9482 | High | 8.8 | 2026-05-25 | A vulnerability has been found in Edimax EW-7438RPn 1.31. This impacts the function formSDHCP of the file /goform/formSDHCP. Such manipulation of the argument… |
CVE-2026-9481 | High | 8.8 | 2026-05-25 | A flaw has been found in Edimax EW-7438RPn 1.31. This affects the function formStats of the file /goform/formStats. This manipulation of the argument submit-ur… |
CVE-2026-9480 | High | 8.8 | 2026-05-25 | A vulnerability was detected in Edimax EW-7438RPn 1.31. The impacted element is the function formrefresh of the file /goform/formrefresh. The manipulation of t… |
CVE-2026-9479 | High | 8.8 | 2026-05-25 | A security vulnerability has been detected in Edimax EW-7438RPn 1.31. The affected element is the function formLogout of the file /goform/formLogout. The manip… |
CVE-2026-9474 | High | 7.3 | 2026-05-25 | A vulnerability was found in yashpokharna2555 StudentManagementSystem up to cb2f558ddf8d19396de0f92abf2d224d46a0a203. Affected by this issue is the function co… |
CVE-2026-9470 | High | 7.3 | 2026-05-25 | A security vulnerability has been detected in yashpokharna2555 StudentManagementSystem cb2f558ddf8d19396de0f92abf2d224d46a0a203. This affects the function conf… |
CVE-2026-9469 | High | 7.3 | 2026-05-25 | A weakness has been identified in yashpokharna2555 StudentManagementSystem cb2f558ddf8d19396de0f92abf2d224d46a0a203. The impacted element is an unknown functio… |
CVE-2026-42782 | High | 7.2 | 2026-05-25 | Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malic… |
CVE-2026-9465 | High | 7.3 | 2026-05-25 | A vulnerability was found in Tiandy Easy7 Integrated Management Platform 7.17.0. This vulnerability affects unknown code of the file /Easy7/apps/WebService/Get… |
CVE-2026-9463 | High | 8.8 | 2026-05-25 | A flaw has been found in Edimax EW-7438RPn 1.31. Affected by this issue is the function formLicence of the file /goform/formLicence. This manipulation of the a… |
CVE-2026-9462 | High | 8.8 | 2026-05-25 | A vulnerability was detected in Edimax EW-7438RPn 1.31. Affected by this vulnerability is the function formWpsProxyEnable of the file /goform/formWpsProxyEnabl… |
CVE-2026-47077 | High | 7.5 | 2026-05-25 | Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. hackney_h3:await_response_loop/6 accumulates the HTTP/3… |
CVE-2026-47075 | High | 7.5 | 2026-05-25 | Improper Neutralization of CRLF Sequences vulnerability in benoitc hackney allows HTTP Request Splitting. hackney does not percent-encode carriage return (\r)… |
CVE-2026-47073 | High | 7.5 | 2026-05-25 | Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. The WebSocket client in src/hackney_ws.erl imposes no up… |
CVE-2026-47072 | High | 7.5 | 2026-05-25 | Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in benoitc hackney allows HTTP Request/Response Splitting. The WebSocket upgrade cod… |
CVE-2026-47071 | High | 7.5 | 2026-05-25 | Uncontrolled Resource Consumption vulnerability in benoitc hackney allows Flooding. The SOCKS5 transport in src/hackney_socks5.erl correctly applies the caller… |
CVE-2026-47067 | High | 7.5 | 2026-05-25 | Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. The URL parser in src/hackney_url.erl converts every unr… |
CVE-2026-47066 | High | 7.5 | 2026-05-25 | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in benoitc hackney allows Excessive Allocation. The Alt-Svc response header parser in src/… |
CVE-2018-25381 | High | 7.1 | 2026-05-25 | Joomla Responsive Portfolio 1.6.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL commands through multipl… |
CVE-2018-25380 | High | 7.1 | 2026-05-25 | Joomla Component eXtroForms 2.1.5 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL commands through the fil… |
CVE-2018-25379 | High | 8.2 | 2026-05-25 | Collectric CMU 1.0 contains a boolean-based blind SQL injection vulnerability in the lang parameter that allows unauthenticated attackers to manipulate databas… |
CVE-2018-25377 | High | 8.4 | 2026-05-25 | Flash Slideshow Maker Professional 5.20 contains a buffer overflow vulnerability in the registration dialog that allows local attackers to execute arbitrary co… |
CVE-2018-25376 | High | 8.4 | 2026-05-25 | Socusoft 3GP Photo Slideshow 8.05 contains a buffer overflow vulnerability in the registration dialog that allows local attackers to execute arbitrary code by… |
CVE-2018-25375 | High | 8.4 | 2026-05-25 | SocuSoft iPod Photo Slideshow 8.05 contains a buffer overflow vulnerability in the registration dialog that allows local attackers to execute arbitrary code by… |
CVE-2018-25374 | High | 7.5 | 2026-05-25 | Softneta MedDream PACS Server Premium 6.7.1.1 contains a directory traversal vulnerability that allows unauthenticated attackers to read arbitrary files by man… |
CVE-2018-25373 | High | 8.4 | 2026-05-25 | SocuSoft DVD Photo Slideshow Professional 8.07 contains a stack-based buffer overflow vulnerability in the registration name field that allows local attackers… |
CVE-2018-25372 | High | 8.2 | 2026-05-25 | MedDream PACS Server Premium 6.7.1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injectin… |
CVE-2018-25371 | High | 8.2 | 2026-05-25 | mooSocial Store Plugin 2.6 contains a blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the produc… |
CVE-2018-25368 | High | 7.5 | 2026-05-25 | Nord VPN 6.14.31 contains a denial of service vulnerability that allows unauthenticated attackers to crash the application by submitting an excessively long st… |
CVE-2018-25366 | High | 8.4 | 2026-05-25 | CuteFTP 5.0 XP contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by injecting malicious payload into the Site Mana… |
CVE-2018-25365 | High | 7.5 | 2026-05-25 | PCViewer vt1000 contains a directory traversal vulnerability that allows unauthenticated attackers to read arbitrary files by submitting relative path sequence… |
CVE-2018-25364 | High | 8.2 | 2026-05-25 | Twitter-Clone 1 contains a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code throu… |
CVE-2018-25362 | High | 8.2 | 2026-05-25 | Twitter-Clone 1 contains a SQL injection vulnerability in follow.php that allows attackers to manipulate database queries by injecting SQL code through the use… |
CVE-2018-25360 | High | 8.4 | 2026-05-25 | AgataSoft Auto PingMaster 1.5 contains a stack-based buffer overflow vulnerability in the Trace Route host name field that allows local attackers to execute ar… |
CVE-2018-25359 | High | 8.4 | 2026-05-25 | Splinterware System Scheduler Pro 5.12 contains an insecure file permissions vulnerability that allows low-privilege users to escalate privileges by modifying… |
CVE-2026-9461 | High | 8.8 | 2026-05-25 | A security vulnerability has been detected in Edimax EW-7438RPn 1.31. Affected is the function formRadius of the file /goform/formRadius. The manipulation of t… |
CVE-2026-9460 | High | 8.8 | 2026-05-25 | A weakness has been identified in Edimax EW-7438RPn 1.31. This impacts the function formAccept of the file /goform/formAccept. Executing a manipulation of the… |
CVE-2026-9459 | High | 8.8 | 2026-05-25 | A security flaw has been discovered in Edimax EW-7438RPn 1.31. This affects the function formConnectionSetting of the file /goform/formConnectionSetting. Perfo… |
CVE-2026-9453 | High | 7.3 | 2026-05-25 | A vulnerability was detected in FoundDream miniclawd up to 2d65665046e2222eeea76cafc8570ed546a8c125. This affects the function which of the file /src/applicati… |
CVE-2026-9452 | High | 7.3 | 2026-05-25 | A security vulnerability has been detected in FoundDream miniclawd up to 2d65665046e2222eeea76cafc8570ed546a8c125. Affected by this issue is the function ExecT… |
CVE-2026-9447 | High | 7.3 | 2026-05-25 | A vulnerability was found in SourceCodester Simple POS and Inventory System 1.0. The impacted element is an unknown function of the file /user/search.php. Perf… |
CVE-2026-9443 | High | 8.8 | 2026-05-25 | A security vulnerability has been detected in Edimax BR-6478AC 1.23. This vulnerability affects the function formL2TPSetup of the file /goform/formL2TPSetup of… |
CVE-2026-9442 | High | 8.8 | 2026-05-25 | A weakness has been identified in Edimax BR-6478AC 1.23. This affects the function formiNICSiteSurvey of the file /goform/formiNICSiteSurvey of the component P… |
CVE-2026-45361 | High | 8.1 | 2026-05-25 | Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Co… |
CVE-2026-9431 | High | 8.8 | 2026-05-25 | A vulnerability was identified in Tenda F1202 1.2.0.20(408). This affects the function fromPptpUserAdd of the file /goform/PptpUserAdd. The manipulation of the… |
CVE-2026-9430 | High | 8.8 | 2026-05-25 | A vulnerability was determined in Tenda F1202 1.2.0.20(408). Affected by this issue is the function formGstDhcpSetSer of the file /goform/GstDhcpSetSerof. Exec… |
CVE-2026-9429 | High | 8.8 | 2026-05-25 | A vulnerability was found in Tenda F1202 1.2.0.20(408). Affected by this vulnerability is the function formWrlExtraSet of the file /goform/WrlExtraSet. Perform… |
CVE-2026-9428 | High | 8.8 | 2026-05-25 | A vulnerability has been found in Tenda F1202 1.2.0.20(408). Affected is the function fromPPTPUserSetting of the file /goform/PPTPUserSetting. Such manipulatio… |
CVE-2026-25193 | High | 8.1 | 2026-05-25 | Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure. Mitig… |
CVE-2026-9427 | High | 8.8 | 2026-05-25 | A flaw has been found in Edimax EW-7438RPn 1.31. This impacts the function formWlSiteSurvey of the file /goform/formWlSiteSurvey of the component webs. This ma… |
CVE-2026-9426 | High | 8.8 | 2026-05-25 | A vulnerability was detected in Edimax EW-7438RPn 1.31. This affects the function formHwSet of the file /goform/formHwSet. The manipulation of the argument Ann… |
CVE-2026-9425 | High | 8.8 | 2026-05-25 | A security vulnerability has been detected in Edimax EW-7438RPn 1.31. The impacted element is the function formWlanMP of the file /goform/formWlanMP. The manip… |
CVE-2026-9422 | High | 7.3 | 2026-05-25 | A vulnerability was identified in KLiK SocialMediaWebsite 1.0. This issue affects some unknown processing of the component HTTP POST Request Parameter Handler… |
CVE-2026-9421 | High | 7.3 | 2026-05-25 | A vulnerability was determined in KLiK SocialMediaWebsite 1.0. This vulnerability affects the function uniqid of the file upload.inc.php of the component File… |
CVE-2026-9403 | High | 8.8 | 2026-05-24 | A vulnerability was determined in Edimax BR-6675nD 1.12. The impacted element is the function formWlSiteSurvey of the file /goform/formWlSiteSurvey of the comp… |
CVE-2026-9401 | High | 8.8 | 2026-05-24 | A vulnerability has been found in Edimax BR-6675nD 1.12. Impacted is the function formWanTcpipSetup of the file /goform/formWanTcpipSetup of the component POST… |
CVE-2026-9399 | High | 8.8 | 2026-05-24 | A vulnerability was detected in Edimax BR-6675nD 1.12. This vulnerability affects the function formsetPPPoE of the file /goform/formsetPPPoE of the component P… |
CVE-2026-9397 | High | 8.1 | 2026-05-24 | A weakness has been identified in Besen BS20 EV Charging Station up to 20260426. Affected by this issue is some unknown functionality of the component OTA Upda… |
CVE-2026-9393 | High | 8.8 | 2026-05-24 | A vulnerability was found in H3C Magic B0 up to 100R002. This affects the function Edit_BasicSSID_5G of the file /goform/aspForm. Performing a manipulation of… |
CVE-2026-9389 | High | 8.8 | 2026-05-24 | A security vulnerability has been detected in Tenda F456 1.0.0.5. This affects the function frmL7ImForm of the file /goform/L7Im. The manipulation of the argum… |
CVE-2026-9383 | High | 7.3 | 2026-05-24 | A vulnerability has been found in itsourcecode Electronic Judging System 1.0. This affects an unknown part of the file /intrams/admin/login.php. The manipulati… |
CVE-2026-4372 | High | 7.8 | 2026-05-24 | A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vulnerability allows… |
CVE-2026-9382 | High | 8.8 | 2026-05-24 | A flaw has been found in Edimax BR-6675nD 1.12. Affected by this issue is the function formPPTPSetup of the file /goform/formPPTPSetup of the component POST Re… |
CVE-2026-9381 | High | 8.8 | 2026-05-24 | A vulnerability was detected in Edimax BR-6675nD 1.12. Affected by this vulnerability is the function formPPPoESetup of the file /goform/formPPPoESetup of the… |
CVE-2026-9380 | High | 8.8 | 2026-05-24 | A security vulnerability has been detected in Edimax BR-6675nD 1.12. Affected is the function formL2TPSetup of the file /goform/formL2TPSetup of the component… |
CVE-2026-9372 | High | 7.3 | 2026-05-24 | A flaw has been found in ItzCrazyKns Vane up to 1.12.1. This vulnerability affects unknown code of the file src/app/api/providers/route.ts of the component Mod… |
CVE-2026-9368 | High | 7.3 | 2026-05-24 | A vulnerability was identified in NousResearch hermes-agent up to 2026.4.16. This impacts the function execute_code of the file tools/code_execution_tool.py of… |
CVE-2026-9367 | High | 7.3 | 2026-05-24 | A vulnerability was determined in NousResearch hermes-agent up to 5157f5427f19488b31c6fdebbacd15d798ce7f63. This affects the function detect_dangerous_command… |
CVE-2026-9366 | High | 7.3 | 2026-05-24 | A vulnerability was found in NousResearch hermes-agent 2026.4.23. The impacted element is the function _scan_context_content of the file agent/prompt_builder.p… |